<html><head></head><body> <div>Hey,</div><div><br></div> <div id="protonmail_mobile_signature_block"><div><span style="color: var(--text-color); background: var(--bg-color);">On Mon, Jan 9, 2023 at 03:50, <</span><a href="mailto:sthaug@nethelp.no" class="">sthaug@nethelp.no</a><span style="color: var(--text-color); background: var(--bg-color);">> wrote:</span><br></div></div><blockquote class="protonmail_quote" type="cite">Example of (part of) query burst - in this case the client sends<br>bursts of 84 queries within less than 1 ms:<br><br>09:24:56.593259 IP 194.19.79.131.58089 > 193.75.75.193.53: 24781+ A? www.jointraining.com. (38)<br>09:24:56.593283 IP 194.19.79.131.38426 > 193.75.75.193.53: 24781+ A? www.jointraining.com. (38)<br>09:24:56.593307 IP 194.19.79.131.56931 > 193.75.75.193.53: 24781+ A? www.jointraining.com. (38)<br>09:24:56.593346 IP 194.19.79.131.42976 > 193.75.75.193.53: 24781+ A? www.jointraining.com. (38)<br>09:24:56.593350 IP 194.19.79.131.11638 > 193.75.75.193.53: 24781+ A? www.jointraining.com. (38)<br>09:24:56.593366 IP 194.19.79.131.22476 > 193.75.75.193.53: 24781+ A? www.jointraining.com. (38)<br>...<br>09:24:56.594364 IP 194.19.79.131.41548 > 193.75.75.193.53: 24781+ A? www.jointraining.com. (38)</blockquote><div><br></div><div><span style="font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-tap-highlight- -webkit-text-stroke-width: 0px; text-decoration: none; caret- font-family: "San Francisco", Helvetica, Arial, sans-serif; -webkit-text-size-adjust: none; float: none; display: inline !important;">Have you looked at the IP TTL within each of these bursts?</span><div style="font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-tap-highlight- -webkit-text-stroke-width: 0px; text-decoration: none; caret- outline: none; font-family: "San Francisco", Helvetica, Arial, sans-serif; -webkit-text-size-adjust: none;"><br style="caret-"></div><div style="font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-tap-highlight- -webkit-text-stroke-width: 0px; text-decoration: none; caret- outline: none; font-family: "San Francisco", Helvetica, Arial, sans-serif; -webkit-text-size-adjust: none;">A random distribution<span class="Apple-converted-space"> </span><caret style="caret-"></caret>might suggest a dispersed set of sources (or ALGs or NATs or something). Patterns might give other clues.</div><div style="font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-tap-highlight- -webkit-text-stroke-width: 0px; text-decoration: none; caret- outline: none; font-family: "San Francisco", Helvetica, Arial, sans-serif; -webkit-text-size-adjust: none;"><br style="caret-"></div><div style="font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-tap-highlight- -webkit-text-stroke-width: 0px; text-decoration: none; caret- outline: none; font-family: "San Francisco", Helvetica, Arial, sans-serif; -webkit-text-size-adjust: none;"><br style="caret-"></div><div style="font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-tap-highlight- -webkit-text-stroke-width: 0px; text-decoration: none; caret- outline: none; font-family: "San Francisco", Helvetica, Arial, sans-serif; -webkit-text-size-adjust: none;">Joe<caret></caret></div></div><blockquote class="protonmail_quote" type="cite"></blockquote></body></html>